General
-
Target
c72756ca6344b675d8951b16ff305d1f8e145bddac1dcac101bfdb79939831a1
-
Size
3.1MB
-
Sample
241216-pgv8naznfw
-
MD5
1ece671b499dd687e3154240e73ff8a0
-
SHA1
f66daf528e91d1d0050f93ad300447142d8d48bc
-
SHA256
c72756ca6344b675d8951b16ff305d1f8e145bddac1dcac101bfdb79939831a1
-
SHA512
0cb5d1084e5e8ec0c30e6d5c559f5a0fd509f96bd5cec7b311d72b8d279e2ffcd9ffbbacb5b428d5ee84aa339743535db0d70afaa3008c6d46508ccaae37adcc
-
SSDEEP
49152:7vTz92YpaQI6oPZlhP3ReybewoqC01JWRoGdl2XTHHB72eh2NT:7vn92YpaQI6oPZlhP3YybewoqCZ
Behavioral task
behavioral1
Sample
c72756ca6344b675d8951b16ff305d1f8e145bddac1dcac101bfdb79939831a1.exe
Resource
win7-20241010-en
Malware Config
Extracted
quasar
1.4.1
SGVP
192.168.1.9:4782
150.129.206.176:4782
Ai-Sgvp-33452.portmap.host:33452
eeeb55fc-ba05-43e4-97f6-732f35b891b4
-
encryption_key
09BBDA8FF0524296F02F8F81158F33C0AA74D487
-
install_name
User Application Data.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windowns Client Startup
-
subdirectory
Quasar
Targets
-
-
Target
c72756ca6344b675d8951b16ff305d1f8e145bddac1dcac101bfdb79939831a1
-
Size
3.1MB
-
MD5
1ece671b499dd687e3154240e73ff8a0
-
SHA1
f66daf528e91d1d0050f93ad300447142d8d48bc
-
SHA256
c72756ca6344b675d8951b16ff305d1f8e145bddac1dcac101bfdb79939831a1
-
SHA512
0cb5d1084e5e8ec0c30e6d5c559f5a0fd509f96bd5cec7b311d72b8d279e2ffcd9ffbbacb5b428d5ee84aa339743535db0d70afaa3008c6d46508ccaae37adcc
-
SSDEEP
49152:7vTz92YpaQI6oPZlhP3ReybewoqC01JWRoGdl2XTHHB72eh2NT:7vn92YpaQI6oPZlhP3YybewoqCZ
-
Quasar family
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-